A Methodology to Detect and Characterize Kernel Level Rootkit Exploits Involving Redirection of the System Call Table

Authors:
John Levine;Julian Grizzard;Henry Owen
Affiliations:
-;-;-
Venue:
IWIA '04 Proceedings of the Second IEEE International Information Assurance Workshop (IWIA'04)
Year:
2004

Citing 4
Cited 9

Computer viruses: theory and experiments

Computers and Security
Applied operating system concepts

Applied operating system concepts
Inside Network Perimeter Security: The Definitive Guide to Firewalls, VPNs, Routers, and Intrusion Detection Systems

Inside Network Perimeter Security: The Definitive Guide to Firewalls, VPNs, Routers, and Intrusion Detection Systems
Understanding the Linux Kernel, 2nd Edition

Understanding the Linux Kernel, 2nd Edition

Using Honeynets to Protect Large Enterprise Networks

IEEE Security and Privacy
The Design of Load-Balancing LMS Based on Decomposition Structure

ICALT '05 Proceedings of the Fifth IEEE International Conference on Advanced Learning Technologies
The Hard SCORM LMS: Reading SCORM Courseware on Hardcopy Textbooks

ICALT '05 Proceedings of the Fifth IEEE International Conference on Advanced Learning Technologies
Reading SCORM compliant multimedia courses using heterogeneous pervasive devices

Proceedings of the 13th annual ACM international conference on Multimedia
Scorm run-time environment as a service

ICWE '06 Proceedings of the 6th international conference on Web engineering
Advanced technology for E-learning development

CIS'09 Proceedings of the international conference on Computational and information science 2009
Software cannot protect software: an argument for dedicated hardware in security and a categorization of the trustworthiness of information

WISTP'08 Proceedings of the 2nd IFIP WG 11.2 international conference on Information security theory and practices: smart devices, convergence and next generation networks
Boosting the adoption of computer managed instruction functionalities in e-learning systems

Journal of Web Engineering
Host based attack detection using system calls

Proceedings of the Second International Conference on Computational Science, Engineering and Information Technology

Quantified Score

Hi-index	0.00

Visualization

Abstract

There is no standardized methodology at present tocharacterize rootkits that compromise the security ofcomputer systems. The ability to characterize rootkitswill provide system administrators with information sothat they can take the best possible recovery actions andmay also help to detect additional instances and preventthe further installation of the rootkit allowing the securitycommunity to react faster to new rootkit exploits. Thereare limited capabilities at present to detect rootkits, but inmost cases these capabilities only indicate that a system isinfected without identifying the specific rootkit. Wepropose a mathematical framework for classifying rootkitexploits as existing, modifications to existing, or entirelynew. An in-depth analysis of a particular type of kernelrootkit is conducted in order to develop acharacterization. As a result of this characterization andanalysis, we propose some new methods to detect thisparticular class of rootkit exploit.